CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-33922?
CVE-2026-33922 is a medium-severity vulnerability in Nozomi Networks Arc, published on 11 Aug 2026.
Official description
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and delete arbitrary files reachable by the Arc process, which runs with administrative privileges on the host.
Weakness: CWE-22
Which versions are affected by CVE-2026-33922?
How do I fix CVE-2026-33922?
No fix has been published for CVE-2026-33922 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33922 being exploited?
There is no known exploitation of CVE-2026-33922 in the wild and no public exploit code.
Sources
Also known as GHSA-28gp-jr6q-rxgq.